Topic: apache/php - knowledge gap

[RayG]

One of the fine people at t-dialin.net have accessed my web server with what I feel is an unusual request:

"HEAD / HTTP/1.0" 200 0 "-" "-"

This would be a probe for the Apache chunked code vulnerability or are there more potential exploits involving this request ?

A quick rpm -q reports "apache-1.3.22-6es1" so I should be up to date for SME 5.5 U2 ?

[Bill Talcott]

From http://www.armbrustconsulting.com/LogEntries.html...

Blank HEAD Requests
"HEAD / HTTP/1.0" 200 0 armbrustconsulting.com "-" "-" "-"

This entry is typically created by Scooter (the AltaVista robot that searches the web) or a similar robot named CheckUrl. When an empty request like this is made (the "0" after the "200" in the above line shows that no HTML was sent by the server) the server only returns information such as wheter the page exists, the date modified, etc. No HTML, metadata or any other type of page content is returned. Meta data is not returned on HEAD, only GET requests. Typically, a search robot makes requests like this a few days before it does a full search on your site, to make sure that the pages from your website that it already has indexed still exist, and whether it needs to update these pages.

At most, it's someone checking out your server. So long as you have a public server, you're going to have people looking at it. The best thing you can do is just keep up with new vulnerabilities and their patches, so that they can't actually do anything to your server, regardless of what info they find out about it.